CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2014-4037
https://notcve.org/view.php?id=CVE-2014-4037
11 Jun 2014 — Cross-site scripting (XSS) vulnerability in editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.php in FCKeditor before 2.6.11 and earlier allows remote attackers to inject arbitrary web script or HTML via an array key in the textinputs[] parameter, a different issue than CVE-2012-4000. Vulnerabilidad de XSS en editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.php en FCKeditor anterior a 2.6.11 y anteriores permite a atacantes remotos inyectar secuencias de comandos... • http://ckeditor.com/blog/FCKeditor-2.6.11-Released • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 4%CPEs: 53EXPL: 3CVE-2012-4000 – FCKEditor Core - 'Editor 'spellchecker.php' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2012-4000
12 Jul 2012 — Cross-site scripting (XSS) vulnerability in the print_textinputs_var function in editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.php in FCKeditor 2.6.7 and earlier allows remote attackers to inject arbitrary web script or HTML via textinputs array parameters. Una vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en la función print_textinputs_var en editor editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.php en FCKeditor v2.6.7 y anteriores permi... • https://www.exploit-db.com/exploits/37457 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 92%CPEs: 27EXPL: 10CVE-2009-2265 – Adobe ColdFusion 8 - Remote Command Execution (RCE)
https://notcve.org/view.php?id=CVE-2009-2265
05 Jul 2009 — Multiple directory traversal vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to create executable files in arbitrary directories via directory traversal sequences in the input to unspecified connector modules, as exploited in the wild for remote code execution in July 2009, related to the file browser and the editor/filemanager/connectors/ directory. Múltiples vulnerabilidades de salto de directorio en FCKeditor anterior a v2.6.4.1, permiten a atacantes remotos crear ficheros ejecutables ... • https://packetstorm.news/files/id/163271 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.1EPSS: 0%CPEs: 27EXPL: 0CVE-2009-2324
https://notcve.org/view.php?id=CVE-2009-2324
05 Jul 2009 — Multiple cross-site scripting (XSS) vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to inject arbitrary web script or HTML via components in the samples (aka _samples) directory. Múltiples vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en FCKeditor anterior a v2.6.4.1, permite a atacantes remotos inyectar secuencias de comandos Web o HTML utilizando componentes en el directorio samples (también conocido como _samples). • http://www.ocert.org/advisories/ocert-2009-007.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 4%CPEs: 11EXPL: 3CVE-2008-6178 – Falt4 CMS RC4 - 'FCKeditor' Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2008-6178
19 Feb 2009 — Unrestricted file upload vulnerability in editor/filemanager/browser/default/connectors/php/connector.php in FCKeditor 2.2, as used in Falt4 CMS, Nuke ET, and other products, allows remote attackers to execute arbitrary code by creating a file with PHP sequences preceded by a ZIP header, uploading this file via a FileUpload action with the application/zip content type, and then accessing this file via a direct request to the file in UserFiles/File/, probably a related issue to CVE-2005-4094. NOTE: some of t... • https://www.exploit-db.com/exploits/8060 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2007-3163
https://notcve.org/view.php?id=CVE-2007-3163
11 Jun 2007 — Incomplete blacklist vulnerability in the filemanager in Frederico Caldeira Knabben FCKeditor 2.4.2 allows remote attackers to upload arbitrary .php files via an alternate data stream syntax, as demonstrated by .php::$DATA filenames, a related issue to CVE-2006-0658. Vulnerabilidad de lista negra incompleta en el gestor de ficheros en Frederico Caldeira Knabben FCKeditor 2.4.2 permite a atacantes remotos actualizar archivos .php de su elección a través de sintaxis alterna de secuencia de datos, como se demo... • http://ha.ckers.org/blog/20070606/additional-image-bypass-on-windows •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2006-2529
https://notcve.org/view.php?id=CVE-2006-2529
22 May 2006 — editor/filemanager/upload/php/upload.php in FCKeditor before 2.3 Beta, when the upload feature is enabled, does not verify the Type parameter, which allows remote attackers to upload arbitrary file types. NOTE: It is not clear whether this is related to CVE-2006-0658. • http://secunia.com/advisories/20122 •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2006-0921
https://notcve.org/view.php?id=CVE-2006-0921
28 Feb 2006 — Multiple directory traversal vulnerabilities in connector.php in FCKeditor 2.0 FC, as used in products such as RunCMS, allow remote attackers to list and create arbitrary directories via a .. (dot dot) in the CurrentFolder parameter to (1) GetFoldersAndFiles and (2) CreateFolder. • http://securityreason.com/securityalert/484 •
CVSS: 9.8EPSS: 5%CPEs: 2EXPL: 4CVE-2006-0658 – FCKEditor 2.0 < 2.2 - 'FileManager connector.php' Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2006-0658
13 Feb 2006 — Incomplete blacklist vulnerability in connector.php in FCKeditor 2.0 and 2.2, as used in products such as RunCMS, allows remote attackers to upload and execute arbitrary script files by giving the files specific extensions that are not listed in the Config[DeniedExtensions][File], such as .php.txt. • https://www.exploit-db.com/exploits/1484 •
CVSS: 9.8EPSS: 3%CPEs: 1EXPL: 2CVE-2005-0613 – InoutMailingListManager 3.1 - Remote Command Execution
https://notcve.org/view.php?id=CVE-2005-0613
28 Feb 2005 — Unknown vulnerability in FCKeditor 2.0 RC2, when used with PHP-Nuke, allows remote attackers to upload arbitrary files. • https://www.exploit-db.com/exploits/3702 •